CVE-2026-69185: socketio socket.io Improper Input Validation
Vulnerability summary
CVE-2026-69185 is a high (CVSS 7.5) Improper Input Validation vulnerability in socketio socket.io. EPSS estimates a 0.63% chance of exploitation in the next 30 days, higher than 49.1% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 03-08-2026PublishedVulnerability first disclosed.
- 03-08-2026Last modifiedVulnerability information updated.
Description
Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 4.2.7, 3.4.5, and 3.3.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory. This vulnerability is fixed in 4.2.7, 3.4.5, and 3.3.6.
CVSS metrics
7 scores · 7 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · WolfiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · NpmEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.63%
Chance of exploitation in the next 30 days
Percentile
49%
Versus all other CVEs
30-day change
+0.13 pp
From 0.50% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- CWE-754Improper Check for Unusual or Exceptional ConditionsThe product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.
Affected systems
Chainguard5 products
- gitlab-rails-ce-19.2< 19.2.2-r3
- gitlab-rails-ce-fips-19.2< 19.2.4-r1
- gitlab-rails-ce-fips-19.3< 19.3.1-r3
- jupyter-base-notebook< 7.6.3-r2
- tensorflow-gpu-jupyterAll versions (No fix recorded)
Debian1 product
- node-socket.io-parserAll versions (No fix recorded) | < 4.2.4+~3.1.2-1
Npm1 product
- socket.io-parser≥ 4.0.0, < 4.2.7 | ≥ 3.4.0, < 3.4.5 | < 3.3.6
Socketio1 product
- socket.io< 3.3.6 | ≥ 3.4.0, < 3.4.5 | ≥ 4.0.0, < 4.2.7
Ubuntu1 product
- node-socket.io-parserAll versions (No fix recorded)
Wolfi1 product
- jupyter-base-notebook< 7.6.3-r2
6 vendors · 10 products
References
10 links- github.com/socketio/socket.io/security/advisories/GHSA-2m8v-j782-fhvrX Refsource CONFIRMREPORTAdvisoryWEB
- github.com/socketio/socket.io/commit/7c6ef571a00656718e9e05e3b948fd1758b2a7b4X Refsource MISCREPORTFIXWEB
- github.com/socketio/socket.io/commit/9c6323e5cde41bd75df3379b5fc9293664a5f240X Refsource MISCREPORTFIXWEB
- github.com/socketio/socket.io/commit/ced94ffa3ac020a8f3c14eb98a3bf34acb14d291X Refsource MISCREPORTFIXWEB
